Bug 616895 - (CVE-2010-2783) CVE-2010-2783 IcedTea 'Extended JNLP Services' arbitrary file access
CVE-2010-2783 IcedTea 'Extended JNLP Services' arbitrary file access
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
public=20100728,reported=20100721,sou...
: Reopened, Security
Depends On: 624818
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-21 12:53 EDT by Marc Schoenefeld
Modified: 2015-08-19 04:50 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-19 11:59:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Comment 1 Marc Schoenefeld 2010-08-16 06:29:40 EDT
Unsigned apps can read/write arbitrary files.
Comment 2 Marc Schoenefeld 2010-08-16 06:30:26 EDT
This issue affected the versions of the java-1.6.0-openjdk package, as
shipped with Fedora release of 12 and 13, it is fixed with IcedTea6 1.8.1 [1,2]. 

[1] https://admin.fedoraproject.org/updates/java-1.6.0-openjdk
[2] http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-181-released/

--

Statement:

This issue does not affect the version of the java-1.6.0-openjdk package, as
shipped with Red Hat Enterprise Linux 5.
Comment 4 Vincent Danen 2010-08-17 16:42:59 EDT
This issue has not been fully resolved, re-opening.
Comment 5 Deepak Bhole 2010-08-19 11:59:06 EDT
After some clarification, it turns out that the issue is resolved and has been backported to 1.7.4.
Comment 6 Vincent Danen 2010-08-19 12:55:00 EDT
That clarification would be the upstream notification that 1.7.4 corrects these flaws:

http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/

Note You need to log in before you can comment on or make changes to this bug.